Privacy Policy
Last updated: 11 August 2026
This policy explains what personal data Vimmo collects, why, on what legal basis, how long it is kept and how to exercise your rights. It covers vimmo.fr and every service reachable from your account.
euRepresentative — see Administration → Vimmo → Identité légale.1. Data controller
The controller of your personal data is:
Numenor Group LLC — Limited Liability Company (LLC) de droit de l’État de New York, États-Unis188 Grand Street, Unit 343, New York, NY 10013, États-Unis
Privacy contact: privacy@vimmo.fr
Publication director: Julien Laglasse
Representative in the European Union: [to be completed]
Hosting provider: Google Cloud EMEA Limited — 70 Sir John Rogerson’s Quay, Dublin 2, Irlande
No Data Protection Officer has been appointed: the processing does not fall under the mandatory designation cases of Article 37 GDPR. Any request about your data is handled at the address above.
2. Purposes, legal bases and retention periods
We only collect what each purpose requires. For every purpose, here is the legal basis under Article 6 GDPR and the retention period applied.
| Purpose | Data involved | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account | First/last name, email, phone, password (hashed), language | Performance of a contract (art. 6(1)(b)) | Lifetime of the account, then anonymised immediately on deletion |
| Publish and distribute your listings | Listing content, photos, property address, contact details | Performance of a contract (art. 6(1)(b)) | Lifetime of the account |
| Identity verification (KYC) | Identity document or proof uploaded, document type | Legitimate interest (art. 6(1)(f)): preventing fraudulent listings | The file is deleted as soon as the verification decision is made. Only the outcome and its date are kept. |
| Search alerts and notifications | Search criteria, email, notification preferences | Performance of a contract (art. 6(1)(b)) | Until the alert or the account is deleted |
| Viewing requests and introductions | Name, email, phone, message, proposed slots | Performance of a contract (art. 6(1)(b)) | 3 years after the last exchange |
| Payments and invoicing | Amount, order history, transaction reference | Legal obligation (art. 6(1)(c)) — accounting records | 10 years (art. L.123-22 French Commercial Code) |
| Account security and fraud prevention | IP address, browser, device id, login timestamps | Legitimate interest (art. 6(1)(f)) | 12 months, then the IP address is anonymised |
| Service emails (confirmation, password reset) | Email, name | Performance of a contract (art. 6(1)(b)) | Lifetime of the account |
| Remembering searches and viewed listings | Search and browsing history | Consent (art. 6(1)(a)) — "Comfort & preferences" category | Stored in your browser only, erased as soon as consent is withdrawn |
3. Identity verification: what happens to your document
Uploading an identity document is optional. It is used solely to confirm you are who you claim to be, in order to limit fraudulent listings. You can use Vimmo without providing one; only some paid features and the "verified listing" badge depend on it.
The file is transmitted over HTTPS and stored encrypted in a private bucket, separate from any public content. It is never publicly accessible and no permanent URL exists: authorised staff access it through a signed link valid for 5 minutes, generated on demand.
As soon as a verification decision is made — accepted or rejected — the file is permanently deleted from our servers. We keep only the outcome ("verified" / "rejected"), its date and, where applicable, the rejection reason. None of that contains any data printed on your document.
If you delete your account before verification, the file is destroyed immediately, without waiting for a decision.
4. Recipients and processors
We neither sell nor rent your data. It is accessible to our authorised staff and to the following technical providers, acting as processors and entitled to handle it only on our instructions.
| Provider | Role | Data location |
|---|---|---|
| Google Cloud Platform | Hosting of the application, database and files | European Union (Belgium, France) |
| Google Maps Platform | Map rendering and address autocomplete | United States — Standard Contractual Clauses |
| Stripe | Payment processing and fraud prevention | European Union / United States — Standard Contractual Clauses |
| Amazon Web Services (SES) | Transactional email delivery | European Union (Paris) |
| IPInfo | Country detection to pick language and currency | United States — only our servers' IP is sent, never yours |
5. Transfers outside the European Union
Some processors above are established in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, supplemented where applicable by the provider's certification under the EU-US Data Privacy Framework. No identity data (ID document, proof of address) leaves the European Union: those files are stored exclusively in our Belgium-hosted storage.
6. Security
The site is served over HTTPS only, with HSTS. Passwords are hashed (bcrypt) and never stored in clear text. Sessions rely on first-party cookies with CSRF protection.
Identity documents are isolated in a dedicated private bucket, separate from any public content, reachable only through a short-lived signed link and restricted to authorised administrator accounts.
No system is infallible. Should a breach be likely to result in a high risk to your rights, you will be informed in accordance with Article 34 GDPR.
7. Your rights
The GDPR grants you the following rights over your personal data:
- Access (art. 15) — obtain a copy of the data we hold about you
- Rectification (art. 16) — correct inaccurate or incomplete data
- Erasure (art. 17) — request deletion of your data
- Restriction (art. 18) — freeze the use of your data while a claim is examined
- Portability (art. 20) — retrieve your data in a structured, machine-readable format
- Objection (art. 21) — object to processing based on our legitimate interest
- Withdrawal of consent (art. 7(3)) — withdraw a consent at any time, without affecting the lawfulness of processing already carried out
- Post-mortem directives — decide what happens to your data after your death (art. 85, French Data Protection Act)
Access, portability and erasure are available directly from "Preferences → Account". For any other request, write to the address in section 1: we reply within one month, extendable to three for complex requests (art. 12(3)).
8. Lodging a complaint with the CNIL
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority (CNIL), 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, or online at www.cnil.fr.
9. Cookies & trackers
Vimmo keeps tracker usage to a strict minimum. We use no ad pixel and no Google Analytics. The only advertising cookies are those of Google AdSense, which displays ads on the site, and they are set only with your consent. In line with the GDPR and CNIL guidance, anything that isn't strictly necessary is only stored with your prior consent.
Strictly necessary
access_token and refresh_token (sign-in, 1 h / 30 days), csrf_token (anti-CSRF protection), plus your language and currency preferences. These are exempt from consent as they are essential to the service. During checkout, Stripe also sets anti-fraud cookies, on payment pages only.
Comfort & preferences
If you consent, your recent searches and the listings you have viewed are stored locally on your device (localStorage) so they can be offered back to you. This data never leaves your browser and is not sent to our servers. Declining stores nothing; withdrawing immediately erases any data already stored.
Audience measurement
No audience measurement is currently active. This category exists so that, if a statistics tool were ever added, it would only be set with your consent.
Advertising
If you consent, ads are displayed on Vimmo by Google AdSense. Google and its advertising partners then set cookies to deliver these ads, cap how often they are shown, measure their performance, prevent fraud and, where applicable, show you personalised ads based on your visits to Vimmo and other websites. Google processes this data on its own behalf, under its own privacy policy, and may transfer it to the United States: how Google uses data from partner sites. You can turn off ad personalisation in Google's ad settings. Declining this category shows no ads and sets no advertising cookie.
You can review and change your choices at any time: